High · published March 1, 2021
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 7.0.0, ≤ 7.0.107 | — |
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.61 | — |
| apache/tomcat | ≥ 9.0.0, ≤ 9.0.41 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_cloud_native_core_security_edge_protection_proxy | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/database | all versions | — |
| oracle/database | all versions | — |
| oracle/database | all versions | — |
| oracle/graph_server_and_client | < 21.3.0 | 21.3.0 |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.23 | — |
| oracle/siebel_ui_framework | < 21.9 | 21.9 |
| oracle/siebel_ui_framework | all versions | — |